PT-2026-23439 · Backstage · Backstage

Published 2026-03-05 · Updated 2026-03-07 · CVE-2026-29184

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.1.4

Description Backstage is a framework for building developer portals. A malicious scaffolder template can bypass the log redaction mechanism, potentially exposing secrets provided through task event logs. The attack requires the ability to register a template in the catalog and a victim executing the malicious template. As a workaround, a custom permission policy can be implemented to restrict access to scaffolder task logs, allowing users to only read their own logs. Restricting template registration in the catalog to trusted users is also recommended.

Recommendations Update to version 3.1.4 or later. Implement a custom permission policy that restricts scaffolder.task.read access. Restrict template registration in the catalog to trusted users only.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-29184

GHSA-8QP7-FHR9-FW53

Affected Products

Backstage

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29184.json · Exploit
• https://github.com/backstage/backstage/security/advisories/GHSA-8qp7-fhr9-fw53 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-29184 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29184 · Security Note
• https://osv.dev/vulnerability/GHSA-8qp7-fhr9-fw53 · Vendor Advisory
• https://github.com/backstage/backstage · Note
• https://backstage.io/docs/permissions/plugin-authors/01-setup · Note
• https://t.me/cveNotify/154590 · Telegram Post
• https://backstage.io/docs/overview/threat-model · Note
• https://twitter.com/CVEnew/status/2030339314484384104 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2030321910874071182 · Twitter Post